Make Private DNS permissions and enablement safe for rollout #691

Activity

1. ecv commented on Oct 22, 2026

   

   ecv

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Detail, as of #631 at 2b967ea:

   1. NetworkContext.spec.dns carries nameservers, searches and accessBindingRef. The runbook says to allow only trusted controllers to write it, but no ValidatingAdmissionPolicy enforces that.
   2. config/rbac/role.yaml grants write on dnsresolvercontexts, dnsresolveraccessbindings and galactic serviceendpoints and serviceroutepolicies unconditionally. The runbook notes that a runtime flag does not revoke RBAC.
   3. go.mod pins go.datum.net/galactic v0.6.3-0.20261021151056-bb0b4c057338. Pin a tag once galactic#851 releases.
   4. An empty spec.dns.mode means Managed once internalDNS.enabled is on. The runbook calls the flag a global switch.

   Also: networkBindingRequestsForContext now lists bindings in every namespace even with the flag off, and the commit deleted the comment above TestACopyLosesALabelItsSourceDropped.
2. ecv

   added

   tech-debtWorkarounds/pins/shortcuts to revisitWorkarounds/pins/shortcuts to revisit

   on Oct 22, 2026
3. scotwells

   added a parent issue on Oct 29, 2026

   • Connect private networks to Private DNS automatically #777
4. scotwells

   added the

   Bug

   issue type on Oct 29, 2026
5. scotwells commented on Oct 29, 2026

   

   scotwells

   on Oct 29, 2026

   Contributor

   More actions

   The description now explains the problem and expected outcome in plain language. The original report is preserved below for the observations, diagnostics, and implementation details behind this work. It describes the situation when the issue was reported; later comments and the issue state record subsequent progress.

   Original report and engineering evidence

   Internal DNS for networks, from Enable private DNS resolution for networks, ships with four loose ends that did not block the review.

   1. Nothing stops a writer other than the operator from changing the resolver settings that reach guest interfaces.
   2. The operator permissions for the new DNS and galactic resources apply to every deployment, even with the feature off.
   3. The galactic dependency is a branch build, not a release.
   4. Turning the feature on enables DNS for every existing network that has not opted out.

   Done when each is enforced, released or documented as accepted. The detail is in the first comment.

   Related to Enable private DNS resolution for networks
6. scotwells

   changed the title [-]Internal DNS for networks: unenforced writes, broad permissions, branch pin[/-] [+]Make Private DNS permissions and enablement safe for rollout[/+] on Oct 29, 2026